Approved changes feed: RSS · Atom

cpe:2.3:a:openidc:liboauth2:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorOpenidc (ee2aeb60-bc45-5177-8b2e-2be2efdd818e)
ProductLiboauth2 (40fffb30-898e-5027-a04f-418d664b344d)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from gcve-enriched-dumps CVE data

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2026-54431 vulnerable 2026-07-29 01:00:27.815253 Improper Data Validation in liboauth2
In liboauth2 the Demonstrating Proof-of-Possession (DPoP) verifier accepts a proof whose JSON Web Key (jwk) header contains private key material. RFC 9449 section 4.3 step 7 requires the verifier to reject such a proof but oauth2_token_verify() function returns success for a malformed DPoP proof that embeds the private Elliptic Curve (EC) key in the header. This issue was fixed in version 2.3.0
Published: 2026-07-02T10:30:57.655Z
Updated: 2026-07-02T12:16:41.569Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-54430 vulnerable 2026-07-29 01:00:27.814909 Server-Site Request Forgery in liboauth2
liboauth2 is vulnerable to Server-Side Request Forgery in oauth2_jose_jwks_aws_alb_resolve() function. The AWS ALB verifier reads both signer and kid from the unverified JWT header. If signer matches the configured ARN, kid is appended to alb_base_url without URL encoding or path sanitization, and the HTTP GET is issued before signature verification. This allows an attacker to force the server to send a GET request to an attacker-chosen internal path. This issue was fixed in version 2.3.0
Published: 2026-07-02T10:30:33.766Z
Updated: 2026-07-02T12:17:21.724Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.